EN 18031 and RED: cybersecurity for radio equipment and the CRA

01RED's cybersecurity requirements

Delegated Regulation (EU) 2022/30 activated three essential requirements in Article 3(3) of RED (2014/53/EU) for certain radio equipment. They have been mandatory since 1 August 2025:

• Article 3(3)(d): the equipment must not harm the network or its functioning nor misuse network resources. Applies to radio equipment that can communicate over the internet.
• Article 3(3)(e): safeguards protecting the user's personal data and privacy. Applies to equipment processing personal data, and to childcare equipment, toys and wearables.
• Article 3(3)(f): protection from fraud. Applies to equipment that can transfer money, monetary value or virtual currency.

02The EN 18031 series

The standards define security mechanisms such as access control, authentication, secure update, secure storage, secure communication, resilience, network monitoring, traffic control, protection of confidential cryptographic keys and up-to-date cryptography, together with decision trees for whether each applies.

The references of all three standards were published in the Official Journal with restrictions by Commission Implementing Decision (EU) 2025/138. Where a restriction applies to your product, the standard does not give a presumption of conformity and an EU-type examination by a notified body is needed.

For example, options that let users operate the product without setting a password are among the typical points affected by the restrictions. Check against the text of the Implementing Decision whether your product is affected.

03The move to the CRA

The CRA also covers radio equipment and addresses the topics of RED's cybersecurity requirements. To avoid duplicate rules, the Commission has prepared a draft to repeal Delegated Regulation 2022/30 from 11 December 2027, when the CRA fully applies. Check the current status on EUR-Lex.

In practice:

• For radio equipment placed on the market until 11 December 2027, RED's cybersecurity requirements and EN 18031 apply.
• CRA Article 14 reporting has applied to radio equipment too since 11 September 2026. Conformity with RED does not remove it. See the Article 14 guide.
• Work done for EN 18031 largely carries over to CRA Annex I Part I. The CRA additionally requires vulnerability handling (Annex I Part II), an SBOM, a support period and reporting.
• EN 18031 is not a CRA harmonised standard. CRA standards are being developed by CEN, CENELEC and ETSI.

04Frequently asked questions